CVE-2026-53988

Deferred Deferred - Pending Action

Authentication Bypass in Dockhand Git Webhook Endpoints

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-53988

EUVD

EUVD-2026-89409

Affected Vendors & Products

Vendor	Product	Version / Range
finsys	dockhand	to 1.0.40 (exc)
docker	docker_compose	5.3.1-r3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Dockhand before version 1.0.40 has an authentication bypass flaw in its Git webhook endpoints. This allows unauthenticated attackers to trigger arbitrary stack redeployments by sending unsigned webhook requests. Attackers can exploit this to force git clone and docker compose operations, potentially causing denial of service or, if they have write access to the git branch, container escape and full host compromise via malicious docker-compose.yml files with privileged bind mounts.

Detection Guidance

Check if Dockhand is running a version before 1.0.40 by inspecting the version output or logs. Look for unauthorized git webhook requests or unexpected stack redeployments in system logs. Monitor for unusual docker-compose operations or privileged container activity.

Impact Analysis

This vulnerability can lead to denial of service attacks by forcing unnecessary redeployments. If an attacker gains write access to the git branch, they could execute container escape and compromise the entire host system through privileged docker-compose.yml files. Unauthorized redeployments may also disrupt services or leak sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access and control over systems, potentially exposing sensitive data. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could violate safeguards for protected health information, leading to compliance failures and penalties.

Mitigation Strategies

Upgrade Dockhand to version 1.0.40 or later immediately. Ensure Docker Compose is updated to version 5.3.1-r3 or newer. Review and restrict access to git webhook endpoints, enforce strong webhook secrets, and audit existing stack configurations for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-53988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70